SSCP Systems and Application Security Practice Question
Which of the following OWASP Top 10 vulnerabilities involves an attacker sending malicious data to an interpreter as part of a command or query?
⚠ Common exam trap
SSCP often tests the distinction between injection attacks and other OWASP Top 10 categories like XSS, which also involve injecting malicious data but target the client-side browser rather than a server-side interpreter.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Injection
Injection is the OWASP Top 10 category that directly involves an attacker sending malicious data to an interpreter as part of a command or query. This occurs when untrusted data is concatenated into a command or query without proper validation or parameterization, allowing the attacker to alter the intended execution. Examples include SQL injection, OS command injection, and LDAP injection, where the interpreter executes the attacker's injected commands. The core reasoning is that the vulnerability arises from the lack of separation between data and code, enabling the attacker to control the interpreter's behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security Misconfiguration
Why it's wrong here
Security misconfiguration covers insecure defaults, exposed services and missing hardening, not attacker-supplied data reaching an interpreter. It is tempting because misconfiguration often enables injection, but the vulnerability described is the injection itself, where untrusted input is interpreted as a command or query.
- ✓
Injection
Why this is correct
Injection flaws occur when untrusted data is sent to an interpreter as part of a command or query, causing it to execute unintended commands. This matches the stem's description of malicious data reaching an interpreter directly, distinguishing it from broken access control or misconfiguration.
- ✗
Broken Authentication
Why it's wrong here
Broken authentication concerns weaknesses in credential handling, session management and identity verification, not malicious data passed to an interpreter. It is tempting because authentication flaws frequently precede injection attacks, yet the described vulnerability is the interpreter receiving attacker-controlled input as a command or query.
- ✗
Cross-Site Scripting (XSS)
Why it's wrong here
XSS is a client-side injection but specifically into web pages, not interpreters.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.